fix(project): address CodeRabbit review — dry-run bypass and TOCTOU in readSecretFileGuarded

- Move secret-file resolution in runAutoAuth to after the dry-run early
  return so --dry-run never touches the filesystem (matches runCreate /
  runUpdate behaviour)
- Wrap the final readFileSync in readSecretFileGuarded with a try-catch
  so EACCES or any other read failure after a successful statSync is
  converted to a structured VALIDATION_ERROR (exit 5) instead of a raw
  Node error
- Add test: runAutoAuth --dry-run with a missing --password-file returns
  the sample without touching the network or filesystem
- Add test: TOCTOU path — file unreadable after stat → VALIDATION_ERROR
  (skipped when running as root)

Author: OkeyAmy

src/commands/project.test.ts

@@ -1,4 +1,4 @@
-import { mkdirSync, mkdtempSync, writeFileSync } from 'node:fs';
+import { chmodSync, mkdirSync, mkdtempSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
@@ -1605,4 +1605,55 @@ describe('#282 — secret --*-file flags are guarded (structured error, exit 5,
       ),
     ).rejects.toMatchObject({ code: 'VALIDATION_ERROR', exitCode: 5 });
   });
+
+  it('runAutoAuth --dry-run with missing --password-file skips filesystem (returns sample)', async () => {
+    const { credentialsPath } = makeCreds();
+    let fetched = false;
+    const fetchImpl = makeFetch(() => {
+      fetched = true;
+      return { body: {} };
+    });
+    const result = await runAutoAuth(
+      {
+        profile: 'default',
+        output: 'json',
+        debug: false,
+        dryRun: true,
+        projectId: 'p1',
+        method: 'password',
+        inject: 'bearer',
+        passwordFile: missingPath(),
+      },
+      { credentialsPath, fetchImpl, stdout: () => {}, stderr: () => {} },
+    );
+    expect(fetched).toBe(false);
+    // blindfold: manual — dry-run skips file reads; returns sample with the projectId we passed in
+    expect(result.projectId).toBe('p1');
+  });
+
+  it('runCredential --credential-file unreadable after stat → VALIDATION_ERROR (exit 5)', async () => {
+    if (process.getuid?.() === 0) return; // root bypasses permission checks
+    const { credentialsPath } = makeCreds();
+    const dir = mkdtempSync(join(tmpdir(), 'cli-cred-mode-'));
+    const f = join(dir, 'secret.txt');
+    writeFileSync(f, 'tok');
+    chmodSync(f, 0o000);
+    try {
+      await expect(
+        runCredential(
+          {
+            profile: 'default',
+            output: 'json',
+            debug: false,
+            projectId: 'p1',
+            authType: 'API key',
+            credentialFile: f,
+          },
+          deps(credentialsPath),
+        ),
+      ).rejects.toMatchObject({ code: 'VALIDATION_ERROR', exitCode: 5 });
+    } finally {
+      chmodSync(f, 0o644);
+    }
+  });
 });

src/commands/project.ts

@@ -574,7 +574,26 @@ export async function runAutoAuth(
     throw localValidationError(`--inject must be one of: ${AUTO_AUTH_INJECTS.join(', ')}`);
   }
 
+  const enabled = opts.disable !== true;
+
+  const idempotencyKey = opts.idempotencyKey ?? `cli-proj-autoauth-${randomUUID()}`;
+  if (opts.idempotencyKey === undefined && (opts.output === 'json' || opts.verbose || opts.debug)) {
+    stderr(`idempotency-key: ${idempotencyKey}`);
+  }
+
+  if (opts.dryRun) {
+    const sample: CliProjectAutoAuthResponse = {
+      projectId: opts.projectId,
+      enabled,
+      method: opts.method,
+      inject: opts.inject,
+    };
+    out.print(sample, data => renderAutoAuthText(data as CliProjectAutoAuthResponse));
+    return sample;
+  }
+
   // Resolve secrets from --*-file variants so they stay out of shell history.
+  // Placed after the dry-run early return so --dry-run never touches the filesystem.
   const password =
     opts.password ??
     (opts.passwordFile !== undefined
@@ -591,7 +610,6 @@ export async function runAutoAuth(
       ? readSecretFileGuarded(opts.refreshTokenFile, 'refresh-token-file')
       : undefined);
 
-  const enabled = opts.disable !== true;
   const body: Record<string, unknown> = { enabled, method: opts.method, inject: opts.inject };
   const maybe = (k: string, v: string | undefined): void => {
     if (v !== undefined) body[k] = v;
@@ -611,22 +629,6 @@ export async function runAutoAuth(
   maybe('scope', opts.scope);
   maybe('region', opts.region);
 
-  const idempotencyKey = opts.idempotencyKey ?? `cli-proj-autoauth-${randomUUID()}`;
-  if (opts.idempotencyKey === undefined && (opts.output === 'json' || opts.verbose || opts.debug)) {
-    stderr(`idempotency-key: ${idempotencyKey}`);
-  }
-
-  if (opts.dryRun) {
-    const sample: CliProjectAutoAuthResponse = {
-      projectId: opts.projectId,
-      enabled,
-      method: opts.method,
-      inject: opts.inject,
-    };
-    out.print(sample, data => renderAutoAuthText(data as CliProjectAutoAuthResponse));
-    return sample;
-  }
-
   const client = makeClient(opts, deps);
   const res = await client.put<CliProjectAutoAuthResponse>(
     `/projects/${encodeURIComponent(opts.projectId)}/auto-auth`,
@@ -1127,7 +1129,17 @@ function readSecretFileGuarded(path: string, flagName: string): string {
     });
   }
 
-  return readFileSync(absolute, 'utf8').trim();
+  let content: string;
+  try {
+    content = readFileSync(absolute, 'utf8');
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    throw secretFileError(flagName, 'must point to a readable file', {
+      path: absolute,
+      error: message,
+    });
+  }
+  return content.trim();
 }
 
 function secretFileError(